Analysis
-
max time kernel
42s -
max time network
155s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
22-02-2024 22:06
Behavioral task
behavioral1
Sample
7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2.apk
-
Size
1.1MB
-
MD5
a9cb55488b48219352f8c0eb7b5c3b72
-
SHA1
5bd952beda27c8c16d88a3ac5e55a1ff9f1e67ef
-
SHA256
7c7e4213746a2816953fc46ce73e69a1b38ded44263a810a4eaedde8511800a2
-
SHA512
9fb71720a0a6322e2d86fa349cb9c5dcdc78fe2e2f93601d403bf4ea1b87488d0b8006e3b0dd5cf29d08d6f525f919e9fa47e13c7bb9cd54b48fab8622f6e246
-
SSDEEP
24576:f0AVatewyf+fWGsGzGYPz2LXR5yPkoMOgSYv:M+j2fWGPXyDD2TgSE
Malware Config
Extracted
hook
http://93.123.39.169
Signatures
-
Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
-
Makes use of the framework's Accessibility service 2 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.tencent.mm Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.tencent.mm -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs 1 IoCs
description ioc Process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.tencent.mm -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.tencent.mm -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.tencent.mm
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD591556b1a6723a1e258bdf0bf2571f37d
SHA1d13b19eaa9659f3214e8a2187a21c1e6ec0feb60
SHA256f17db38b2cc8b8d1672b3e3ad12440f1003af1f0cc11042dbee0f87eaf52d86d
SHA51201a5fa3c0f313e3f2f23ea9d21ab7a96fecec27fdf9a9f2ad96a312b693e76250902cf6213936d05601c07fbe9ceb9d5e7722415f1b4dbeddfd2139628827800
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
16KB
MD533b757a9543e08abc2532108c8245347
SHA14ee543a8e42d29e85f6bc48cd13949e0b02e5fd7
SHA25663eb8f970fcdfb999cd32e9d92d0888f6837afbb44581b43fb9ee18e0bbed1ba
SHA512711a9d2025efa31a4f6411c163d7a58469aa88487843a00804347bea09d8a9852ededaf0395ba49c2b3458398b120a9d8024c43c20e321be32acbce23f5aa189
-
Filesize
108KB
MD57099c77c4f1500d7e8718e6b093fada7
SHA109febd4d1aa6f27725e62f4e8248000038e5fea5
SHA2562080335e9e6f6913abb9e45913cf085b9f02891d327541cc558748dcb5599aac
SHA512ec9315e0bf27e14155fa978c5cd722c4de9e9cc5d1368e8cead792ff74506cef7081f089f4b8c3cfaefedda6b829d972aff6944d7ba06d6eee76fde6ba740bb6
-
Filesize
173KB
MD513ecc56ac7eabb679781ee8c7c441eeb
SHA14b4654d042d9a177ee1d35ca6c43f8119b7d1ace
SHA25624b9b92d6b87f7aeaa3d58a5da95fc881608a591be5baee14afa493be69e7fa3
SHA512f47315575fa723c2fcfbb3ad5afa95028a1b4b10e8838751140960ec1e3188136a8c9da8f2930cc12188a9eefd132ce2e3e6205efd0465dc9bb909f3c34382eb